EUVD-2026-46371
GHSA-w2x9-vqwg-9g25
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local attack requiring low-privilege account; world-readable file needs no race condition (AC:L); only partial IPC data disclosed, no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in graph.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Insecure file creation in the Perl CPAN module Data::Graph::Shared before version 0.04 exposes inter-process communication (IPC) payloads to any local user on the system. The mmap backing file used for shared memory segments is created with permissions 0666 (effectively 0644 after umask), making stored IPC data world-readable in shared directories such as /tmp or /dev/shm. Two additional missing flags - O_EXCL and O_NOFOLLOW - allow a local attacker to either win a pre-creation race to substitute their own file or plant a symlink to redirect the open call. No public exploit code has been identified and EPSS is 0.16% (6th percentile), consistent with limited real-world exploitation interest.
Technical ContextAI
Data::Graph::Shared is a Perl CPAN module authored by EGOR that implements shared in-memory graph structures via mmap-backed files. The root cause is a CWE-732 (Incorrect Permission Assignment for Critical Resource) in graph.h, where the file open call is open(path, O_RDWR|O_CREAT, 0666). Three distinct insecure practices compound here: the 0666 mode results in world-readable files (0644) after a default umask of 022 is applied, so any local user can read the raw IPC segment contents without any privileges; the absence of O_EXCL means if a file or symlink already exists at the target path, the open silently succeeds against it rather than failing, enabling a pre-creation race attack; and the absence of O_NOFOLLOW means a symlink planted at the expected path is transparently followed, redirecting segment creation or reads to an attacker-controlled file. The affected CPE is cpe:2.3:a:egor:data::graph::shared:*:*:*:*:*:*:*:* for all versions before 0.04.
RemediationAI
Upgrade Data::Graph::Shared to version 0.04 or later via CPAN (cpan install Data::Graph::Shared or cpanm Data::Graph::Shared); this is the vendor-confirmed fix per the release diff at https://metacpan.org/release/EGOR/Data-Graph-Shared-0.04/changes. If immediate upgrading is not possible, a compensating control is to configure the application to use a dedicated per-application directory (e.g. /run/myapp/ with mode 0700 owned by the service account) rather than /tmp or /dev/shm for the mmap backing file, which eliminates the world-readable exposure and prevents other local users from planting files or symlinks at the expected path. This workaround requires application-level configuration changes and does not fix the underlying O_EXCL/O_NOFOLLOW deficiencies.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today